Security Logging, Monitoring, and Retention
Troy University Information Technology maintains a centralized security logging and monitoring program designed to support the detection, investigation, and response to cybersecurity threats, unauthorized activity, system anomalies, and other events that may affect the confidentiality, integrity, or availability of University information systems.
The University’s security logging and monitoring activities support its established information security program, including the requirements of the Gramm-Leach-Bliley Act (GLBA), applicable University information security policies, and recognized cybersecurity practices.
Centralized Security Monitoring
Information Technology utilizes co-managed telemetry log tools and Event Management (SIEM) technology to centrally collect, correlate, analyze, and retain security telemetry generated throughout the University’s technology environment.
Security telemetry collected and monitored includes:
- Network telemetry: Firewall events, network security alerts, network traffic information, intrusion detection, and other network-related security activity.
- Endpoint telemetry: Security events and behavioral information generated by University-managed workstations, servers, and endpoint security technologies.
- Microsoft 365 telemetry: Authentication events, identity-related activity, administrative actions, and other available security events associated with the University’s Microsoft 365 environment.
- Security and behavioral telemetry: Events and alerts generated by other security platforms, behavioral analytics technologies, and threat detection systems.
Security Event Review and Response
Information Technology maintains ongoing security monitoring through its SIEM and associated security technologies.
Security events are evaluated through automated correlation rules, threat detection mechanisms, behavioral analysis, and other monitoring capabilities. Events identified as potentially malicious or otherwise requiring investigation are reviewed by authorized Information Technology security personnel.
Security events are prioritized according to their severity, potential impact, affected systems, and associated risk.
When appropriate, identified security events are investigated, documented, escalated, and addressed through established security operations and incident response procedures.
Information Technology personnel periodically review security monitoring activities, alerts, and identified offenses to evaluate the effectiveness of security controls and identify opportunities for improvement.
Security Log Retention
Troy University maintains security telemetry to support cybersecurity investigations, incident response, operational security monitoring, regulatory compliance, and institutional risk management.
As a general institutional standard, security logs and telemetry collected through the University’s centralized security monitoring infrastructure should be retained for a minimum of twelve (12) months, subject to applicable technical capabilities and regulatory requirements.
Where supported by the University’s security infrastructure, at least ninety (90) days of recent security telemetry should remain readily accessible for operational review and investigation.
Security records associated with an active investigation, security incident, legal hold, regulatory inquiry, or other institutional requirement may be retained for longer periods, as necessary.
Troy University currently maintains historical security telemetry within its SIEM environment beyond the proposed minimum retention period. The University may continue retaining these records when operationally appropriate and consistent with applicable information security, privacy, and records management requirements.
Retention periods may be adjusted based upon system capabilities, information sensitivity, applicable regulatory obligations, operational requirements, and institutional risk assessments.
Log Protection and Access Control
Access to centralized security telemetry is restricted to authorized Information Technology personnel and other individuals with an established institutional need.
Security logging systems are protected through appropriate administrative, technical, and access controls designed to prevent unauthorized access, modification, or destruction of security records.
Administrative access and activities involving security monitoring infrastructure are subject to applicable University information security and access management requirements.
Log Disposition
Security telemetry that has exceeded its applicable retention requirements may be securely removed through established system administration, storage management, or records disposition processes.
Information Technology evaluates operational, investigative, regulatory, and institutional requirements before implementing significant changes to security log retention or disposition practices.
Records associated with active investigations, litigation holds, or other preservation requirements are excluded from routine disposition until the applicable retention obligation has been satisfied.
Roles and Responsibilities
Information Technology security personnel are responsible for administering the University’s centralized security monitoring infrastructure, reviewing identified security events, coordinating investigations, and maintaining appropriate security logging capabilities.
System administrators and other responsible Information Technology personnel support security monitoring by maintaining appropriate logging configurations and facilitating the collection of relevant security telemetry from systems within their areas of responsibility.
The University’s security logging and monitoring practices are periodically evaluated and adjusted in response to changes in technology, cybersecurity threats, institutional requirements, and applicable regulatory obligations.